Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
Date:   Thu, 27 Jul 2023 11:50:28 -0700
In-Reply-To: <ZMK8ch6N/s3mbK6F@casper.infradead.org>
Message-ID: <0000000000001f3ae506017c704b@google.com>
Subject: Re: [syzbot] [mm?] WARNING: suspicious RCU usage in mas_walk (2)
From:   syzbot <syzbot+8645fe63c4d22c8d27b8@syzkaller.appspotmail.com>
To:     willy@infradead.org
Cc:     akpm@linux-foundation.org, liam.howlett@oracle.com,
        linux-kernel@vger.kernel.org, linux-mm@kvack.org,
        syzkaller-bugs@googlegroups.com, willy@infradead.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

> On Tue, Jul 25, 2023 at 11:57:22PM -0700, syzbot wrote:
>> syzbot has bisected this issue to:
>
> FWIW, this is unrelated to the previous issue.  It's the caller of
> mas_walk() that has violated the locking constraints, and mas_walk() is
> simply reporting the issue.  Is there a way to get syzbot to understand
> that it needs to unwind the call-stack further to decide who to blame?
>
>> commit a52f58b34afe095ebc5823684eb264404dad6f7b
>> Author: Matthew Wilcox (Oracle) <willy@infradead.org>
>> Date:   Mon Jul 24 18:54:10 2023 +0000
>> 
>>     mm: handle faults that merely update the accessed bit under the VMA lock
>> 
>> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1783585ea80000
>> start commit:   [unknown] 
>> git tree:       linux-next
>> final oops:     https://syzkaller.appspot.com/x/report.txt?x=1443585ea80000
>> console output: https://syzkaller.appspot.com/x/log.txt?x=1043585ea80000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=f481ab36ce878b84
>> dashboard link: https://syzkaller.appspot.com/bug?extid=8645fe63c4d22c8d27b8
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1697cec9a80000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1566986ea80000
>
> #syz test

want 2 args (repo, branch), got 4

>
> diff --git a/mm/memory.c b/mm/memory.c
> index 20a2e9ed4aeb..57b271108bdc 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -3567,6 +3567,12 @@ static vm_fault_t do_wp_page(struct vm_fault *vmf)
>  		return 0;
>  	}
>  copy:
> +	if ((vmf->flags & FAULT_FLAG_VMA_LOCK) && !vma->anon_vma) {
> +		pte_unmap_unlock(vmf->pte, vmf->ptl);
> +		vma_end_read(vmf->vma);
> +		return VM_FAULT_RETRY;
> +	}
> +
>  	/*
>  	 * Ok, we need to copy. Oh, well..
>  	 */